401 Authorization Required when send logs from Fluentbit to Loki gateway with ingress and basic-auth #8721

Angel0r · 2024-04-16T12:19:00Z

Angel0r
Apr 16, 2024

Hello,

I am using the grafana/loki Helm Chart. Since it is going to be in production I am trying to use Loki gateway ingress with and basic-auth. When I enable ingress and basic auth I get the following error:

[2024/04/16 11:40:03] [error] [output:loki:loki.0] loki-gateway.com:443, HTTP status=401
<html>
<head><title>401 Authorization Required</title></head>
<body>
<center><h1>401 Authorization Required</h1></center>
<hr><center>nginx/1.24.0</center>
</body>
</html>

My configuration looks like below:
Loki:

    gateway:
      enabled: true
      replicas: 1
      verboseLogging: true
      ingress:
        enabled: true
        ingressClassName: "nginx"
        annotations: 
          nginx.ingress.kubernetes.io/auth-secret: loki-gateway-tls
          nginx.ingress.kubernetes.io/auth-type: basic
        labels: {}
        hosts:
          - host: loki-gateway.com
            paths:
              - path: /
                pathType: Prefix
        tls:
          - secretName: loki-gateway-tls
            hosts:
              - loki-gateway.com

Secret(loki-gateway-tls):

apiVersion: v1
data:
  auth: dXNlcm5hbWU6JDJ5JDA1JGdvbWR2cUtkQjd4U0UxNFp5ZllhYWVjOE1tWk5WSGFBblRkcnRpcVp4MkpFVG9pY1RlSmlX
kind: Secret
metadata:
  annotations:
    sealedsecrets.bitnami.com/namespace-wide: "true"
  creationTimestamp: "2024-04-15T07:04:25Z"
  name: loki-gateway-tls
  namespace: logs-and-monitoring
  ownerReferences:
  - apiVersion: bitnami.com/v1alpha1
    controller: true
    kind: SealedSecret
    name: loki-gateway-tls
type: Opaque

Fluentbit:

        [OUTPUT]
            Name                   loki
            Match                  *
            Host                   loki-gateway.com
            Port                   443
            Http_User              username
            Http_Passwd            password
            TLS                    On
            tls.verify             On
            Labels                 job=fluentbit
            Auto_Kubernetes_Labels on
            Compress               gzip

I tested the ingress with username and password and it works fine:

curl -v -u username:password https://loki-gateway.com:443

What am I missing?

/Angelos

agup006 · 2024-04-17T20:45:22Z

agup006
Apr 17, 2024
Maintainer

Does that user have permissions to write to loki?

1 reply

Angel0r Apr 18, 2024
Author

Hello @agup006,

Hmm. I am running this in Kubernetes and I just created an htpasswd for the basicauth. Do I need to assign roles and create rolesbindings?

Angel0r · 2024-04-18T11:38:14Z

Angel0r
Apr 18, 2024
Author

In Loki values, if I disable gateway and enable ingress and then use tls/basicauth there it works fine.
https://github.com/grafana/loki/blob/main/production/helm/loki/values.yaml#L1136

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

401 Authorization Required when send logs from Fluentbit to Loki gateway with ingress and basic-auth #8721

{{title}}

Replies: 2 comments 1 reply

{{title}}

{{title}}

{{title}}

Select a reply

401 Authorization Required when send logs from Fluentbit to Loki gateway with ingress and basic-auth #8721

Angel0r Apr 16, 2024

Replies: 2 comments · 1 reply

agup006 Apr 17, 2024 Maintainer

Angel0r Apr 18, 2024 Author

Angel0r Apr 18, 2024 Author

Angel0r
Apr 16, 2024

Replies: 2 comments 1 reply

agup006
Apr 17, 2024
Maintainer

Angel0r Apr 18, 2024
Author

Angel0r
Apr 18, 2024
Author